EUVD-2026-59777
GHSA-c8h5-32j5-pvrj
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable TR-069 service with hard-coded credentials; AC:H retained because credential discovery is nominally required; PR:N as credentials grant access without prior device privileges; no scope change beyond the router.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Hard-coded TR-069 remote management credentials in LB-LINK X-PRO firmware 1.0.22-20231206 allow network-accessible unauthenticated attackers to authenticate to the device's CWMP interface via static credentials embedded in /etc/config/easycwmp. A public proof-of-concept exploit has been released, effectively eliminating the primary barrier to exploitation. The vendor was unresponsive to coordinated disclosure, and no patch has been issued; no public exploit identified at time of analysis as confirmed active exploitation (CISA KEV listing absent), though publicly available exploit code exists.
Technical ContextAI
LB-LINK X-PRO is a consumer/SOHO router that embeds easycwmp, an open-source TR-069 (CWMP - CPE WAN Management Protocol) client used by ISPs for remote management of customer-premises equipment. TR-069 operates over HTTP/HTTPS, typically on TCP port 7547, and relies on credentials stored in /etc/config/easycwmp to authenticate the device with the ISP's Auto Configuration Server (ACS). CWE-259 (Use of Hard-coded Password) describes the root cause: static credentials are compiled or written into the firmware configuration and cannot be changed by the end user, meaning any party who extracts the firmware image or reads the published PoC can authenticate using those credentials without any additional privileges. Because TR-069 allows the ACS to push arbitrary configuration changes, an attacker with valid credentials gains administrative-level control over the router's configuration. No CPE string was provided in the available data; the affected product and version are identified solely by vendor name and firmware build date.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure. The primary compensating control is disabling TR-069/CWMP remote management entirely if ISP-managed configuration is not required; this eliminates the exposed service but may prevent legitimate ISP provisioning. If TR-069 must remain active, apply strict firewall rules to restrict inbound access to TCP port 7547 exclusively to the ISP's documented ACS IP ranges, blocking all other hosts - note this requires knowledge of the ISP's ACS addresses and may need periodic updating. Network segmentation placing the router's management plane on a separate VLAN inaccessible from untrusted hosts provides defense in depth. Monitor VulDB entry https://vuldb.com/vuln/390091 for any future vendor patch release. Consider replacing the device with hardware from a vendor that actively responds to security disclosures.
Same weakness CWE-259 – Use of Hard-coded Password
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today